IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Original) A network security apparatus comprising: 

a billing server configured to calculate security protection consumption during a period of 
time by quantifying damages avoided by one or more blocked attacks. 

2. (Original) The apparatus of claim 1, wherein calculating security protection consumption 
further includes determining whether a blocked attack would have exploited a network 
vulnerability. 

3. (Previously presented) The apparatus of claim 2, wherein determining whether a blocked 
attack would have exploited network vulnerability includes replaying the attack on an internal 
network. 

4. (Original) The apparatus of claim 1 5 further comprising a scanner configured to scan one or 
more devices for vulnerabilities. 

5. (Original) The apparatus of claim 4, wherein the scanner is configured to quantify the risk of 
one or more devices. 

6. (Original) The apparatus of claim 4, wherein the scanner is located within a customer 
network. 

7. (Original) The apparatus of clam 1 5 further comprising an intrusion suppression module 
configured to block attacks. 

8. (Original) The apparatus of claim 7, wherein the intrusion suppression module is configured 
to maintain a list of attacks sustained and blocked during a period of time. 
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9. (Original) The apparatus of claim 7, wherein the intrusion suppression module is located 
outside a customer network. 



10. (Previously presented) A network security method comprising: 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

1 1 . (Previously presented) The method of claim 1 0 5 further comprising determining whether a 
blocked attack would have exploited network vulnerability. 

12. (Previously presented) The method of claim 10, further comprising scanning one or more 
devices for vulnerabilities. 

13. (Previously presented) The method of claim 12, further comprising quantifying the risk of 
one or more devices. 

14. (Previously presented) The method claim 1, further comprising blocking one or more 
attacks. 

15. (Previously presented) The method of claim 14, further comprising maintaining a list of 
attacks sustained and blocked during a period of time. 

16. (Original) A network security apparatus comprised of: 

means for quantifying damages avoided by one or more blocked attacks; and 
means for calculating security protection consumption during a period of time. 

17. (Original) The apparatus of claim 16, further comprised of the means for determining 
whether a blocked attack would have exploited network vulnerability. 

18. (Original) The apparatus of claim 16, further comprised of the means for scanning one or 
more devices for vulnerabilities. 
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19. (Original) The apparatus of claim 18, further comprised of the means for quantifying the risk 
of one or more devices. 

20. (Original) The apparatus claim 16, further comprised of the means for blocking one or more 
attacks. 

21. (Original) The apparatus of claim 20, further comprised of the means for maintaining a list 
of attacks sustained and blocked during a period of time. 

22. (Previously presented) A computer program product embodied in a tangible computer- 
readable medium, and comprising computer instructions for: 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

r" 

\ 

23. (Previously presented) The computer program product of claim 21, further comprising 
computer instructions for determining whether a blocked attack would have exploited network 
vulnerability. 

24. (Previously presented) The computer program product of claim 2 1 , further comprising 
computer instructions for scanning one or more devices for vulnerabilities. 

25. (Currently amended) The computer program product [[of]] of claim 21, further 
comprising computer instructions for quantifying risk of one or more devices. 

26. (Previously presented) The computer program product of claim 21 , further comprising 
computer instructions blocking one or more attacks. 

27. (Previously presented) The computer program product of claim 26, further comprising 
computer instructions for maintaining a list of attacks sustained and blocked during a period of 
time. 
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28. (Cancelled) 
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